CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/sched: reject overly deep qdisc hierarchies

Deep qdisc hierarchies can lead to excessive recursion in qdisc tree
walkers and exhaust the kernel stack. The existing loop check does not
cover the create-and-graft path, so a hierarchy can still be extended by
creating a new child qdisc below an already deep parent.

Store the hierarchy depth in struct Qdisc and update it when qdiscs are
grafted. Reject new child qdiscs once the parent is already at the maximum
allowed depth.

The Linux kernel CVE team has assigned CVE-2026-74663 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 6.1.183 with commit 9f69bb9fdaa2fe64b68bb62fb84d405784bee540
	Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 6.6.152 with commit 8ca8cdb74939581339e1ae370193c0adb5a85336
	Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 6.12.104 with commit 2759acf08a3454866660edcd3ef4e64139f254a6
	Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 6.18.45 with commit a4b14a4df29d36458a943f9b521ddd0f940363cc
	Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 7.1.9 with commit e2d658c6427844cee5bc654b436ca68d680b6148
	Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 7.2 with commit dedd34b0f2310e28c5f6d4875cfbf4b7ed821c01

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74663
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/net/sch_generic.h
	net/sched/sch_api.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9f69bb9fdaa2fe64b68bb62fb84d405784bee540
	https://git.kernel.org/stable/c/8ca8cdb74939581339e1ae370193c0adb5a85336
	https://git.kernel.org/stable/c/2759acf08a3454866660edcd3ef4e64139f254a6
	https://git.kernel.org/stable/c/a4b14a4df29d36458a943f9b521ddd0f940363cc
	https://git.kernel.org/stable/c/e2d658c6427844cee5bc654b436ca68d680b6148
	https://git.kernel.org/stable/c/dedd34b0f2310e28c5f6d4875cfbf4b7ed821c01